I received an email the other day that I was not sure was spam. It appeared that the user had just mistyped my email address.

I responded and advised the user of his error, and also stated that any other emails sent to me, other than a response to my request, would be reported as spam.

Over the next three days I received 5 more emails, with the same message in the body. Since I had not received a response to my request, I reported all of the emails as spam.

Today I received an email from the Admin of the source ISP. This is what he said...



Well, I would like to advise this Admin that he is incorrect, and indeed, all of the messages were sent to me, after I requested the issue be resolved. But, I do not want to use my email, revealing my address. Maybe he has it anyway, maybe he does not. I do not see taking the chance to expose it if he does not have it. Any ideas?

First obvious would be the tool at http://sneakemail.com ... generate an address, use it, and if it gets banged too hard, delete it, generate a new one, whatever ...

Maybe I'm out to lunch here, but if the Admin sent you an e-mail, doesn't that mean he/she already has your address? So, sending mail to the Admin wouldn't reveal anything new.

?

No, they sent email to the spamcop reply address that they are given with the reports. That email is forwarded to me.

The sneakmail.com thing worked. Thanks

I keep receiving the same email, from this same person. The odd thing is that it is dated Tuesday.

Something like either his client is messed up and keeps sending it or my ISP's server is screwed and it keeps delivering it to my inbox.

I just received one this morning and noticed the date was a Tuesday's date. I proccessed it anyway and this is what it said...

Sorry, this email is too old to file a spam report. You must report spam within 3 days of receipt. This mail was received on Tue, 30 Mar 2004 22:03:55 -0500
Nothing to do

Now why would it do that if I just received it this morning?

Just a note, I use two different clients to check my account and both of them did not show it until this morning. Then they both showed I had mail, I retrieved it with one and it did not appear for either after that.

One thought was that someone had experienced a system failure and whipped up a set of back-ups, that included this e-mail .. however, if it was the source, you shouldn't have gotten the 3-day notice, as the (normally) most recent time-stamp would have been from your ISP.

So, if we then move to your ISP having the failure .. well, one would think that they'd have a bit of a notice about the crash (of course, possible assumption there on your ISP <g>)

The "two e-mail clients" pretty much rules out your system. (though there could be the configuration change to "leave e-mail on server" . but you'd be saying that the e-mail was "still" there if that was the case)

The only plausible (?) thing left would be that this e-mail is mangled in such a fashion that it's not clearing out of your spool on your ISP's box .. but, as above, you'd be saying that it's still there at each following mail run.

OK, you start with "keep receiving" but then menton "one this morning" .. maybe I'm not totally getting it .. "keep receiving" is defined as what?

Wondering now if there's something about the fact that you didn't reply from "your account" (the reference that sneakemail worked) .. and you're being baited to work you into responding from that "targeted" account? ... But again, if it was "new" e-mail, the time-date stamp should have been from "today" at your ISP's server ...???

Keep receiving means, I received one two days ago, with the same time stamp, I received on yesterday with the same timestamp (Tuesday the 30th), and then again this morning. I have kept them all.

It is the same email as far as I can tell but I am trying to figure out why it is being sent over and over, or where it is mangled. At this time my account is not showing it is here.

My ISP is Cox.net. They have web based mail too. When I am at work during the week I check my mail with the web client. At home I have a little App that notifies me of mail on the server, it is called Eprompter. And finally I use Outlook to retreive my mail.

I received the email mentioned above. I noticed it while at work, logged in web client. I go home, Eprompter tells me i have mail, I look at emprompter and it says this one email is there. I login with outlook, retrieve the email, put it away in a folder.

The next day at work, while on the web client, I notice this email again! Same steps, go home, emprompter says it is there, retrieve it, it is gone from server until I noticed it this morning.

Looks like it is being sent over and over again. Very stange to me

OK, now in sync .. that you have them all is great .. I'd start with looking and comparing the headeers, specifically the top-most lines ... actually looking for the last hand-off the cox's server says it handled.

Issue 1 ... is the date-time stamp the same?
Issue 2 .. is is actually the same server?

Not familiar with Eprompter, but there are some of these monitoring tools that will let you reach out and smack the spam before pulling up your main e-mail app. Perhaps another one of these little tools or even a TELNET session to actually insure the message is really removed from your spool? Or is this where one should say "take it up with Cox" ????

Strange, I just notice, although the date is the same, the time is just a little different on the email I have saved. Although, there are duplicates on these as well. How I noticed this was the size of the email is slightly different, one is 9k and the other is 10k.

Here are the headers... The first two have the same time stamp of 8:04 pm. One of these was received in my inbox this morning and the other was a day or so ago.

I have removed the To: portion to protect email address...
---------------------------------------------------------------------------------------
Return-Path: <****@fnni.com>
Received: from c60.cesmail.net ([216.154.195.49]) by lakemtai04.cox.net
(InterMail vM.5.01.06.08 201-253-122-130-108-20031117) with ESMTP
id <20040331030355.BUGL26746.lakemtai04.cox.net[at]c60.cesmail.net>
for <****@cox.net>; Tue, 30 Mar 2004 22:03:55 -0500
Received: from unknown (HELO blade4.cesmail.net) (192.168.1.214)
by c60.cesmail.net with SMTP; 30 Mar 2004 21:27:06 -0500
Received: (qmail 12582 invoked by uid 1010); 31 Mar 2004 02:27:06 -0000
Delivered-To: spamcop-net-****@spamcop.net
Received: (qmail 12476 invoked from network); 31 Mar 2004 02:27:02 -0000
Received: from unknown (HELO c60.cesmail.net) (192.168.1.105)
by blade4.cesmail.net with SMTP; 31 Mar 2004 02:27:02 -0000
Received: from mailgate.cesmail.net (216.154.195.36)
by c60.cesmail.net with SMTP; 30 Mar 2004 21:27:01 -0500
Received: (qmail 17467 invoked from network); 31 Mar 2004 02:27:01 -0000
Received: from unknown (HELO mailgate.cesmail.net) (192.168.1.101)
by mailgate.cesmail.net with SMTP; 31 Mar 2004 02:27:01 -0000
Received: from pop.west.cox.net [68.6.19.2]
by mailgate.cesmail.net with POP3 (fetchmail-6.2.1)
for ****@spamcop.net (single-drop); Tue, 30 Mar 2004 21:27:01 -0500 (EST)
Received: from old.fnni.com ([204.58.233.240]) by lakemtai02.cox.net
(InterMail vM.5.01.06.08 201-253-122-130-108-20031117) with ESMTP
id <20040331013221.BGSX25724.lakemtai02.cox.net[at]old.fnni.com>;
Tue, 30 Mar 2004 20:32:21 -0500
Received: from worldtalk.fnbo.com (worldtalk.fnbo.com [192.168.79.27])
by old.fnni.com with SMTP id i2ULmt6X004476;
Tue, 30 Mar 2004 16:45:15 -0600 (CST)
Received: from 172.16.33.122 by worldtalk.fnbo.com with ESMTP (
Tumbleweed MMS SMTP Relay (MMS v4.7); Tue, 30 Mar 2004 16:42:42 -0600
X-Server-Uuid: b40b4260-68f5-11d4-98ee-00508bdcae1a
Received: by FNCES04 with Internet Mail Service (5.5.2650.21) id
<GRAPGZHM>; Tue, 30 Mar 2004 16:45:11 -0600
From: "Kloock, Zac" <***@fnni.com>
To: ****
Subject: Log In
Date: Tue, 30 Mar 2004 16:45:08 -0600
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2650.21)
X-WSS-ID: 6C7728681803874-01-01
Content-Type: multipart/alternative;
boundary="----_=_NextPart_001_01C416A8.A892AF5E"
X-H-S-Loop-Check-Ejzfr:
Message-Id: <20040331013221.BGSX25724.lakemtai02.cox.net[at]old.fnni.com>
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on blade4
X-Spam-Level: *
X-Spam-Status: hits=1.8 tests=FORGED_MUA_IMS,HTML_40_50,HTML_FONTCOLOR_BLUE,
HTML_FONT_BIG,HTML_MESSAGE version=2.63
X-SpamCop-Checked: 192.168.1.105 216.154.195.36 192.168.1.101 68.6.19.2 204.58.233.240 5.1.6.8 192.168.79.27 172.16.33.122

--------------------------------------------------------------------------------------------

Return-Path: <****@fnni.com>
Received: from c60.cesmail.net ([216.154.195.49]) by lakemtai04.cox.net
(InterMail vM.5.01.06.08 201-253-122-130-108-20031117) with ESMTP
id <20040331030355.BUGL26746.lakemtai04.cox.net[at]c60.cesmail.net>
for <****@cox.net>; Tue, 30 Mar 2004 22:03:55 -0500
Received: from unknown (HELO blade4.cesmail.net) (192.168.1.214)
by c60.cesmail.net with SMTP; 30 Mar 2004 21:27:06 -0500
Received: (qmail 12582 invoked by uid 1010); 31 Mar 2004 02:27:06 -0000
Delivered-To: spamcop-net-****@spamcop.net
Received: (qmail 12476 invoked from network); 31 Mar 2004 02:27:02 -0000
Received: from unknown (HELO c60.cesmail.net) (192.168.1.105)
by blade4.cesmail.net with SMTP; 31 Mar 2004 02:27:02 -0000
Received: from mailgate.cesmail.net (216.154.195.36)
by c60.cesmail.net with SMTP; 30 Mar 2004 21:27:01 -0500
Received: (qmail 17467 invoked from network); 31 Mar 2004 02:27:01 -0000
Received: from unknown (HELO mailgate.cesmail.net) (192.168.1.101)
by mailgate.cesmail.net with SMTP; 31 Mar 2004 02:27:01 -0000
Received: from pop.west.cox.net [68.6.19.2]
by mailgate.cesmail.net with POP3 (fetchmail-6.2.1)
for ****@spamcop.net (single-drop); Tue, 30 Mar 2004 21:27:01 -0500 (EST)
Received: from old.fnni.com ([204.58.233.240]) by lakemtai02.cox.net
(InterMail vM.5.01.06.08 201-253-122-130-108-20031117) with ESMTP
id <20040331013221.BGSX25724.lakemtai02.cox.net[at]old.fnni.com>;
Tue, 30 Mar 2004 20:32:21 -0500
Received: from worldtalk.fnbo.com (worldtalk.fnbo.com [192.168.79.27])
by old.fnni.com with SMTP id i2ULmt6X004476;
Tue, 30 Mar 2004 16:45:15 -0600 (CST)
Received: from 172.16.33.122 by worldtalk.fnbo.com with ESMTP (
Tumbleweed MMS SMTP Relay (MMS v4.7); Tue, 30 Mar 2004 16:42:42 -0600
X-Server-Uuid: b40b4260-68f5-11d4-98ee-00508bdcae1a
Received: by FNCES04 with Internet Mail Service (5.5.2650.21) id
<GRAPGZHM>; Tue, 30 Mar 2004 16:45:11 -0600
From: "Kloock, Zac" <****@fnni.com>
To: ****
Subject: Log In
Date: Tue, 30 Mar 2004 16:45:08 -0600
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2650.21)
X-WSS-ID: 6C7728681803874-01-01
Content-Type: multipart/alternative;
boundary="----_=_NextPart_001_01C416A8.A892AF5E"
X-H-S-Loop-Check-Ejzfr:
Message-Id: <20040331013221.BGSX25724.lakemtai02.cox.net[at]old.fnni.com>
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on blade4
X-Spam-Level: *
X-Spam-Status: hits=1.8 tests=FORGED_MUA_IMS,HTML_40_50,HTML_FONTCOLOR_BLUE,
HTML_FONT_BIG,HTML_MESSAGE version=2.63
X-SpamCop-Checked: 192.168.1.105 216.154.195.36 192.168.1.101 68.6.19.2 204.58.233.240 5.1.6.8 192.168.79.27 172.16.33.122

-------------------------------------------------------------------------

These next two have the same time stamp of 4:12 pm

Return-Path: <****@fnni.com>
Received: from c60.cesmail.net ([216.154.195.49]) by lakemtai05.cox.net
(InterMail vM.5.01.06.08 201-253-122-130-108-20031117) with ESMTP
id <20040330231226.LDEV25080.lakemtai05.cox.net[at]c60.cesmail.net>
for <****@cox.net>; Tue, 30 Mar 2004 18:12:26 -0500
Received: from unknown (HELO blade4.cesmail.net) (192.168.1.214)
by c60.cesmail.net with SMTP; 30 Mar 2004 18:12:17 -0500
Received: (qmail 12974 invoked by uid 1010); 30 Mar 2004 23:12:15 -0000
Delivered-To: spamcop-net-****@spamcop.net
Received: (qmail 12898 invoked from network); 30 Mar 2004 23:12:12 -0000
Received: from unknown (HELO c60.cesmail.net) (192.168.1.105)
by blade4.cesmail.net with SMTP; 30 Mar 2004 23:12:12 -0000
Received: from mailgate.cesmail.net (216.154.195.36)
by c60.cesmail.net with SMTP; 30 Mar 2004 18:12:12 -0500
Received: (qmail 13086 invoked from network); 30 Mar 2004 23:12:12 -0000
Received: from unknown (HELO mailgate.cesmail.net) (192.168.1.101)
by mailgate.cesmail.net with SMTP; 30 Mar 2004 23:12:12 -0000
Received: from pop.west.cox.net [68.6.19.2]
by mailgate.cesmail.net with POP3 (fetchmail-6.2.1)
for ****@spamcop.net (single-drop); Tue, 30 Mar 2004 18:12:12 -0500 (EST)
Received: from old.fnni.com ([204.58.233.240]) by lakemtai06.cox.net
(InterMail vM.5.01.06.08 201-253-122-130-108-20031117) with ESMTP
id <20040330224633.BCQF24087.lakemtai06.cox.net[at]old.fnni.com>;
Tue, 30 Mar 2004 17:46:33 -0500
X-Server-Uuid: b40b4260-68f5-11d4-98ee-00508bdcae1a
Message-ID: <200403302245.i2ULmt6X004476[at]old.fnni.com>
From: "Kloock, Zac" <****@fnni.com>
To: ****
Subject: Log In
Date: Tue, 30 Mar 2004 16:45:08 -0600
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2650.21)
X-WSS-ID: 6C7728681803874-01-01
Content-Type: multipart/alternative;
boundary="----_=_NextPart_001_01C416A8.A892AF5E"
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on blade4
X-Spam-Level: *
X-Spam-Status: hits=1.8 tests=FORGED_MUA_IMS,HTML_40_50,HTML_FONTCOLOR_BLUE,
HTML_FONT_BIG,HTML_MESSAGE version=2.63
X-SpamCop-Checked: 192.168.1.105 216.154.195.36 192.168.1.101 68.6.19.2 204.58.233.240 5.1.6.8

---------------------------------------------------------------------------------------------------
Return-Path: <****@fnni.com>
Received: from c60.cesmail.net ([216.154.195.49]) by lakemtai05.cox.net
(InterMail vM.5.01.06.08 201-253-122-130-108-20031117) with ESMTP
id <20040330231226.LDEV25080.lakemtai05.cox.net[at]c60.cesmail.net>
for <*****@cox.net>; Tue, 30 Mar 2004 18:12:26 -0500
Received: from unknown (HELO blade4.cesmail.net) (192.168.1.214)
by c60.cesmail.net with SMTP; 30 Mar 2004 18:12:17 -0500
Received: (qmail 12974 invoked by uid 1010); 30 Mar 2004 23:12:15 -0000
Delivered-To: spamcop-net-*****@spamcop.net
Received: (qmail 12898 invoked from network); 30 Mar 2004 23:12:12 -0000
Received: from unknown (HELO c60.cesmail.net) (192.168.1.105)
by blade4.cesmail.net with SMTP; 30 Mar 2004 23:12:12 -0000
Received: from mailgate.cesmail.net (216.154.195.36)
by c60.cesmail.net with SMTP; 30 Mar 2004 18:12:12 -0500
Received: (qmail 13086 invoked from network); 30 Mar 2004 23:12:12 -0000
Received: from unknown (HELO mailgate.cesmail.net) (192.168.1.101)
by mailgate.cesmail.net with SMTP; 30 Mar 2004 23:12:12 -0000
Received: from pop.west.cox.net [68.6.19.2]
by mailgate.cesmail.net with POP3 (fetchmail-6.2.1)
for *****@spamcop.net (single-drop); Tue, 30 Mar 2004 18:12:12 -0500 (EST)
Received: from old.fnni.com ([204.58.233.240]) by lakemtai06.cox.net
(InterMail vM.5.01.06.08 201-253-122-130-108-20031117) with ESMTP
id <20040330224633.BCQF24087.lakemtai06.cox.net[at]old.fnni.com>;
Tue, 30 Mar 2004 17:46:33 -0500
X-Server-Uuid: b40b4260-68f5-11d4-98ee-00508bdcae1a
Message-ID: <200403302245.i2ULmt6X004476[at]old.fnni.com>
From: "Kloock, Zac" <*****@fnni.com>
To: ****
Subject: Log In
Date: Tue, 30 Mar 2004 16:45:08 -0600
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2650.21)
X-WSS-ID: 6C7728681803874-01-01
Content-Type: multipart/alternative;
boundary="----_=_NextPart_001_01C416A8.A892AF5E"
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on blade4
X-Spam-Level: *
X-Spam-Status: hits=1.8 tests=FORGED_MUA_IMS,HTML_40_50,HTML_FONTCOLOR_BLUE,
HTML_FONT_BIG,HTML_MESSAGE version=2.63
X-SpamCop-Checked: 192.168.1.105 216.154.195.36 192.168.1.101 68.6.19.2 204.58.233.240 5.1.6.8

---------------------------------------------------------------------------------------------

Only one thing left to mention. I have two accounts. Account A is my main, public address. Spamcop retrieves email from it, filters, and forwards to account B. Both of my accounts are on Cox.

Thanks

Yes, for each set above, the message ID is the same. But why did I receive one of them a couple days ago and one this morning?

I'm more than a bit confused ... first easy ... one of the servers got really backlogged? Seems to be quite a lot of references to SpamCop slowdowns lately ... but .. I know that doesn't say squat ... but I'm also relating to some experiences with @Home a number of years back. An e-mail server would go down, their techs would swap out the bad system with a good unit, repair the bad unit, and put it on the shelf as the "new spare" ... somewhere down the line, that "new spare" would replace another failed unit, and it'd start procesing all the e-mail that had been sitting on it when it died, thus leading to confused users receiving mail "this morning" but dated a year prior ... it got to be a bit of a contest, who could show the oldest "new" e-mail ...

Back to my confusion ... maybe this is just the way things work, but ... my orignal plan was to copy each set of headers, line up the blocks, and look for the differences. Ok, easy to see that the first two came from your host, the other two from your SpamCop account .. however, I'm very curious as to where the missing lines went. Granted, the ones that got dropped are all "local network" stuff, but exactly where and when do these header lines disappear? Again, maybe this is normal, but if done by SpamCop, this sure flies in the face of "user shall make no material changes" .. well, then again, in this case, no it wouldn't, but .... or is this part of the mail-host thing?

I'm thinking of those virus / spams that Ellen usually comes back with a description of an owned system behind the firewall/server ... and in this case, the traffic behind your server got removed ... interesting, but confusing to me ...

I can't in all honestly report these as spam if something is going on with the way they are delivered.

I will post the headers of any future emails, with an old timestamp, here in this post.

Thanks